DMARC Record Checker

Check a DMARC record against RFC 7489: whether the policy enforces anything, whether reports are going anywhere, and whether pct is quietly letting most spoofed mail through.

Paste below, or drop a file anywhere on this panel

Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.

The answer appears here

Paste on the left and press Check the record. Nothing leaves this tab.

Wanted a different tool?

  • SPF Record Checker because DMARC checks SPF alignment, and an SPF record over the lookup limit fails it for every sender.
  • DKIM Record Checker to check the key the DKIM half of this policy depends on, including whether it has been revoked by an empty p.

Examples

Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.

Monitoring that monitors nothing

p=none with no rua. Nothing is enforced and no reports are collected, so there is never any information on which to raise the policy.

v=DMARC1; p=none

A reject policy that mostly does not reject

pct applies only to the policy and never to reporting, so three quarters of spoofed mail falls back to the weaker policy and is likely delivered.

v=DMARC1; p=reject; pct=25; rua=mailto:dmarc@example.com; sp=reject

A bare address in rua

RFC 7489 requires a URI. A bare address is a syntax error and the record can be discarded entirely, which leaves the domain with no policy.

v=DMARC1; p=quarantine; rua=dmarc@example.com

Enforcing, with subdomains left implicit

Inheritance is usually right and worth stating. A subdomain nobody watches is the easiest way to spoof a brand.

v=DMARC1; p=reject; rua=mailto:dmarc@example.com

Common mistakes

These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.

  1. Publishing `p=none` and considering DMARC done

    Monitoring mode enforces nothing. Every message that fails DMARC is delivered exactly as before, so the domain is as spoofable as it was without a record.

    Instead:Read the aggregate reports until every legitimate sender aligns, then move to quarantine and then reject.

  2. Publishing a policy with no `rua` address

    Aggregate reports are the only thing that tells you which senders would break under enforcement. Without them there is never a safe moment to raise the policy.

    Instead:Add `rua=mailto:` before anything else. Reports are daily XML, so a processing service is worth having.

  3. Leaving `pct` below 100 on a reject policy

    `pct` applies only to the policy, never to reporting. `pct=25` with `p=reject` means three quarters of spoofed mail falls back to the weaker policy and has a good chance of arriving.

    Instead:Use it to roll out, then remove it. A record left at `pct=25` is not enforcing.

  4. Expecting an SPF pass to be a DMARC pass

    DMARC checks ALIGNMENT: whether the domain that passed SPF matches the From header the recipient sees. A vendor sending as you with their own return path passes SPF and fails DMARC.

    Instead:Check alignment in the aggregate reports, and use DKIM signing with your own domain for vendors that cannot align SPF.

  5. Omitting `sp` and assuming subdomains are covered

    They inherit `p`, which is usually right and is worth stating. Inheritance also silently breaks any subdomain that sends mail it cannot align, and a subdomain nobody watches is the easiest way to spoof a brand.

    Instead:Set `sp=reject` explicitly if no subdomain sends mail.

p=none is a monitoring mode, not a policy

DMARC is where SPF and DKIM become a decision. Publishing a record is the easy half; the half that matters is moving off p=none, and most domains that publish DMARC never do.

The three policies, and what each one actually does

p=none means deliver as before and send me reports. p=quarantine means treat a failure as suspicious, which in practice is the spam folder. p=reject means refuse the message at SMTP time. Only the last two stop anyone spoofing the domain, and a record sitting at none provides exactly as much protection as no record at all.

v=DMARC1; p=none; rua=mailto:dmarc@example.com        monitoring
v=DMARC1; p=quarantine; pct=25; rua=mailto:...        rolling out
v=DMARC1; p=reject; sp=reject; rua=mailto:...         enforcing

Without rua there is no path to enforcement

Aggregate reports are the only thing that tells you which senders would break under a policy. Publishing p=none with no rua is monitoring that monitors nothing: you get the delay of the monitoring phase and none of the information, and there is never a safe moment to move to quarantine.

pct is a rollout control and applies only to the policy

pct=25 with p=reject rejects a quarter of failing mail and falls back to quarantine for the rest, so a spoofed message has a good chance of arriving. Reporting is unaffected: reports always cover everything. It is a way to move gradually, not a destination, and a record left at pct=25 for a year is not enforcing.

Alignment is what SPF and DKIM are being checked for

DMARC does not care whether SPF passed. It cares whether the domain SPF passed for aligns with the From header the recipient sees. Relaxed alignment, the default, accepts a subdomain; strict requires an exact match. A vendor sending as you with their own return path passes SPF and fails DMARC, which is the most common surprise when a policy is first enforced.

sp decides what happens to subdomains

Without sp, subdomains inherit p. That is usually right, and being explicit is better: a subdomain nobody is watching is the easiest way to spoof a brand, and inheritance will also silently break any subdomain that sends mail it cannot align. If no subdomain sends mail, sp=reject says so.

What this cannot see

It reads the record and nothing else. It performs no DNS lookups, so it cannot confirm the record is published at _dmarc.yourdomain, cannot check that the rua address accepts reports from other domains, and cannot tell you whether your senders align. Alignment is only answerable from real aggregate reports, which is exactly why rua matters more than any other tag here.

Related email and dns tools

SPF Record Checker Ten lookups and it stops working DKIM Record Checker An empty p is a revocation DNS Record Checker Legal syntax, wrong answer

Elsewhere on the site

Terraform Validator & Formatter Kubernetes YAML Generator Kubernetes YAML Validator AWS IAM Policy Validator & Analyzer